diff options
author | Walter van Niftrik | 2010-01-06 20:22:00 +0000 |
---|---|---|
committer | Walter van Niftrik | 2010-01-06 20:22:00 +0000 |
commit | fc582c0e5975b0591268694fd02430504242b4a2 (patch) | |
tree | 315803932e9d6271a391cfcb535d4090e9532b6c /engines/sci/decompressor.cpp | |
parent | edc7fcf121bf56052858498d3168c344c00d7442 (diff) | |
download | scummvm-rg350-fc582c0e5975b0591268694fd02430504242b4a2.tar.gz scummvm-rg350-fc582c0e5975b0591268694fd02430504242b4a2.tar.bz2 scummvm-rg350-fc582c0e5975b0591268694fd02430504242b4a2.zip |
SCI: Fix overflow in LZS decompressor
svn-id: r47090
Diffstat (limited to 'engines/sci/decompressor.cpp')
-rw-r--r-- | engines/sci/decompressor.cpp | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/engines/sci/decompressor.cpp b/engines/sci/decompressor.cpp index c213fca1ed..7d5064fca2 100644 --- a/engines/sci/decompressor.cpp +++ b/engines/sci/decompressor.cpp @@ -901,7 +901,8 @@ int DecompressorLZS::unpack(Common::ReadStream *src, byte *dest, uint32 nPacked, } int DecompressorLZS::unpackLZS() { - uint16 offs = 0, clen; + uint16 offs = 0; + uint32 clen; while (!isFinished()) { if (getBitsMSB(1)) { // Compressed bytes follow @@ -928,8 +929,9 @@ int DecompressorLZS::unpackLZS() { return _dwWrote == _szUnpacked ? 0 : SCI_ERROR_DECOMPRESSION_ERROR; } -uint16 DecompressorLZS::getCompLen() { - int clen, nibble; +uint32 DecompressorLZS::getCompLen() { + uint32 clen; + int nibble; // The most probable cases are hardcoded switch (getBitsMSB(2)) { case 0: @@ -958,7 +960,7 @@ uint16 DecompressorLZS::getCompLen() { } } -void DecompressorLZS::copyComp(int offs, int clen) { +void DecompressorLZS::copyComp(int offs, uint32 clen) { int hpos = _dwWrote - offs; while (clen--) |